Security

quickssh was designed to keep access credentials from spreading and from being used without permission. This page explains what is stored where and how it is protected.

Master password

If the server is on your own computer, a master password is required to store records.

The record file is encrypted with XChaCha20-Poly1305, using a key derived with Argon2id.
The key is kept only in memory. When the app locks, other quickssh processes (terminal tabs, the command line) can't reach the records either.
Encryption can't be turned off while records exist.

Setting the password asks for two confirmations: a checkbox and a final window before saving. Both say the same thing:

Warning: The master password is not stored anywhere and cannot be recovered. If you lose it, you can't reach your records.

Lock

The app locks on start and when idle. The time is chosen in Settings (1, 5, 15 minutes, 1 hour or never).
On the lock screen you can see the password as you type with the eye icon on the right.
After three wrong attempts the app warns you and offers the reset option.

Reset

If you forgot the master password, the only way is to reset. A reset permanently deletes all records: VPN profiles, sessions, passwords, keys, macros.

So that it isn't done by accident, you have to type a confirmation word (RESET in the English interface, SIFIRLA in Turkish).

quickssh vault reset

If you have a backup, you can import it after the reset.

Backup: export and import

All records, together with their passwords and keys, are written to a single file encrypted with a separate password of your choice.

quickssh export backup.qsx
quickssh import backup.qsx              # records with the same name are skipped
quickssh import backup.qsx --overwrite  # records with the same name are replaced

In the interface it is the Settings → Backup card. The export file's password is independent of the master password; if you forget it, the file can't be opened.

On a central server:

Action	Who can do it
Export	An admin who can see passwords
Import	An admin

The option is not shown to anyone without permission; the server also refuses and logs the attempt.

Access on a central server

Secrets never leave the server. The server connects to the targets. Users use the connection but never see the password; the admin reveals it only to those they allow.
Permissions are granted per record, VPN or group.
OTP lock: if the admin wants, the client unlocks with a one-time code (TOTP) and locks by itself after the set idle time.
External access and database ports are per user and open only to their current IP address.
Temporary access (agent): no permanent login stays on the target; every connection gets its own short-lived key.

Details: Central server.

Audit log

Every connection, file transfer, record change, port opening and refused request is logged under the name of the user who did it. The log is kept for a year.

quickssh log                 # the last 50 entries of the latest day
quickssh log 2026-10-07 -n 0 # that whole day
quickssh log --source alice  # only one user's entries

Users see only their own entries; admins see everyone's. Passwords and entered OTP codes are never logged.

Passwords in headless use

In scripts, passwords can be taken from the environment instead of being asked:

Variable	For
`QUICKSSH_MASTER_PASSWORD`	The master password
`QUICKSSH_EXPORT_PASSWORD`	The export file's password

Warning: Keeping the password in an environment variable gives it to anyone who can see that environment. The risk is yours.